Since it should be obvious at a glance when the ticket is about to expire I added a third icon:
It gets shown together with the first notification, which is tunable via the /apps/krb5-auth-dialog/prompt_minutes gconf key:
gconftool-2 --type=int --set /apps/krb5-auth-dialog/prompt_minutes 30
The code landed on the pkinit branch so the build instructions stay the same. I also added a gconf schema to ease configuration and fixed a possible segfault on startup.